Re: MD5 math question

[Chris Varenhorst <varenc () MIT EDU>]

Its going to be determined by how the hash is being cracked.
A dictionary search is going to have a much much lower probability of 
finding
a collided password then an exhaustive search of all characters (which
would find all collided passwords)  As far as the actual math goes, no idea!




Jeff Robertson wrote:

> Assume that a password between 1 and 24 ASCII characters was stored as
> an MD5 hash. No salt. What is the probability that someone cracking the
> password will find not the password that the user originally chose, but
> a different password that happens to collide with it? Intuitively it
> seems so unlikely that you wouldn't ever expect to see it. But what is
> the probability really?
>
> -------------------------------------------------------------------------------
> Watchfire's AppScan is the industry's first and leading web application 
> security testing suite, and the only solution to provide comprehensive 
> remediation tasks at every level of the application. See for yourself. 
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
> -------------------------------------------------------------------------------
>
>  



Jeff Robertson wrote:

> Assume that a password between 1 and 24 ASCII characters was stored as
> an MD5 hash. No salt. What is the probability that someone cracking the
> password will find not the password that the user originally chose, but
> a different password that happens to collide with it? Intuitively it
> seems so unlikely that you wouldn't ever expect to see it. But what is
> the probability really?
>
> -------------------------------------------------------------------------------
> Watchfire's AppScan is the industry's first and leading web application 
> security testing suite, and the only solution to provide comprehensive 
> remediation tasks at every level of the application. See for yourself. 
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
> -------------------------------------------------------------------------------
>
>  


-------------------------------------------------------------------------------
Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
-------------------------------------------------------------------------------